{"id":"CVE-2024-9825","aliases":["EUVD-2024-50146","GHSA-hjf3-hgq2-9hw3"],"status":"published","title":"The Chef Habitat builder is impacted by Indirect Object reference(IDOR) by deletion of personal access token","description":"The Chef Habitat builder-api on-prem-builder package  with any version lower than habitat/builder-api/10315/20240913162802 is vulnerable to indirect object reference (IDOR) by un-authorized deletion of personal token.  Habitat builder consumes builder-api habitat package as a dependency and the vulnerability was specifically due to builder-api habitat package.\n\nThe fix was made available in habitat/builder-api/10315/20240913162802 and all the subsequent versions after that. We would recommend user to always use on-prem stable channel.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00279,"percentile":0.20571,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-863"],"published":"2024-10-28T18:42:39Z","modified":"2026-06-17T08:25:20Z","products":[{"vendor":"progress software corporation","product":"chef habitat builder"}],"references":[{"url":"https://docs.chef.io/habitat/builder_overview/","tags":["product"]},{"url":"https://community.progress.com/s/article/Chef-Habitat-Builder-Product-Alert","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9825"},{"url":"https://docs.chef.io/habitat/builder_overview"},{"url":"https://github.com/advisories/GHSA-hjf3-hgq2-9hw3"}],"sources":{"cve":[{"id":"CVE-2024-9825","title":"The Chef Habitat builder is impacted by Indirect Object reference(IDOR) by deletion of personal access token","description":"The Chef Habitat builder-api on-prem-builder package  with any version lower than habitat/builder-api/10315/20240913162802 is vulnerable to indirect object reference (IDOR) by un-authorized deletion of personal token.  Habitat builder consumes builder-api habitat package as a dependency and the vulnerability was specifically due to builder-api habitat package.\n\nThe fix was made available in habitat/builder-api/10315/20240913162802 and all the subsequent versions after that. We would recommend user to always use on-prem stable channel.","status":"published","published":"2024-10-28T18:42:39.786Z","modified":"2024-10-29T13:33:52.268Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:34:06.147811Z"}],"euvd":[{"id":"EUVD-2024-50146","description":"The Chef Habitat builder-api on-prem-builder package  with any version lower than habitat/builder-api/10315/20240913162802 is vulnerable to indirect object reference (IDOR) by un-authorized deletion of personal token.  Habitat builder consumes builder-api habitat package as a dependency and the vulnerability was specifically due to builder-api habitat package.\n\nThe fix was made available in habitat/builder-api/10315/20240913162802 and all the subsequent versions after that. We would recommend user to always use on-prem stable channel.","status":"published","published":"2024-10-28T18:42:39Z","modified":"2024-10-29T13:33:52Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:05:15.24326Z"}],"ghsa":[{"id":"GHSA-hjf3-hgq2-9hw3","title":"The Chef Habitat builder-api on-prem-builder package  with any version lower than habitat/builder...","description":"The Chef Habitat builder-api on-prem-builder package  with any version lower than habitat/builder-api/10315/20240913162802 is vulnerable to indirect object reference (IDOR) by un-authorized deletion of personal token.  Habitat builder consumes builder-api habitat package as a dependency and the vulnerability was specifically due to builder-api habitat package.\n\nThe fix was made available in habitat/builder-api/10315/20240913162802 and all the subsequent versions after that. We would recommend user to always use on-prem stable channel.","status":"published","published":"2024-10-28T21:30:34Z","modified":"2024-10-28T21:30:42Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:58:37.515988Z"}],"nvd":[{"id":"CVE-2024-9825","description":"The Chef Habitat builder-api on-prem-builder package  with any version lower than habitat/builder-api/10315/20240913162802 is vulnerable to indirect object reference (IDOR) by un-authorized deletion of personal token.  Habitat builder consumes builder-api habitat package as a dependency and the vulnerability was specifically due to builder-api habitat package.\n\nThe fix was made available in habitat/builder-api/10315/20240913162802 and all the subsequent versions after that. We would recommend user to always use on-prem stable channel.","status":"published","published":"2024-10-28T19:15:15.17Z","modified":"2026-06-17T08:25:20.067Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:10:34.877798Z"}]}}